Privacy Policy

1. Introduction

Matador Media Inc. ("Matador Media," "we," "us," or "our") is a corporation incorporated under the laws of the Province of Ontario, Canada, with its principal place of business in King City, Ontario. We are a digital marketing and artificial intelligence automation agency that provides services including but not limited to website development, search engine optimization, paid advertising management, email marketing, content production, customer relationship management automation, and the MataVoice artificial intelligence voice agent platform ("MataVoice" or the "Platform").

This Privacy Policy (the "Policy") describes how Matador Media collects, uses, discloses, processes, retains, and protects personal information when you (a) visit our website at matadormedia.ca or any related subdomain (collectively, the "Website"), (b) engage Matador Media for professional services under a written or electronic engagement, (c) interact with MataVoice as an end user (including by speaking with a MataVoice-powered voice agent operated by one of our clients), (d) communicate with us through email, telephone, SMS, or any social media channel, or (e) otherwise provide personal information to Matador Media in any form (collectively, the "Services").

This Policy is drafted to comply with PIPEDA, CASL, the Telecommunications Act (Canada), the CRTC's Unsolicited Telecommunications Rules, the GDPR and UK GDPR where applicable, the CCPA/CPRA, and other applicable privacy and data protection laws.

Please read this Policy carefully. By accessing the Website, using any of our Services, or interacting with MataVoice, you acknowledge that you have read and understood the practices described in this Policy. If you do not agree with any part of this Policy, you must not use the Website, the Services, or MataVoice.

2. Scope and Application

This Policy applies to all personal information processed by Matador Media in the course of operating its business, including information collected from Website visitors, prospective and current clients, end users who interact with MataVoice-powered voice agents ("Callers"), vendors and partners, job applicants, and subscribers.

2.1 Matador Media as a Data Controller

When Matador Media collects personal information about its own clients, prospects, employees, and Website visitors, Matador Media acts as the data controller (or, under PIPEDA, the "organization" responsible for the information). In this capacity, Matador Media determines the purposes and means of processing.

2.2 Matador Media as a Data Processor / Service Provider

When Matador Media processes personal information on behalf of a client (for example, when MataVoice records and analyzes a call between a Caller and one of our automotive dealership clients), Matador Media acts as a data processor (under GDPR), a service provider (under CCPA/CPRA), or an agent (under PIPEDA). The client remains the data controller, and Matador Media processes the data only in accordance with the client's written instructions and the applicable DPA.

3. Identity of the Controller and Contact Information

The data controller responsible for personal information processed under this Policy is:

Matador Media Inc.
King City, Ontario, Canada
Privacy inquiries: privacy@matadormedia.ca
General contact: hello@matadormedia.ca
Privacy Officer: Tristan, Founder and Privacy Officer

You may direct any questions, complaints, access requests, or correction requests to the Privacy Officer at the address above. We respond to verifiable requests within the timelines required by applicable law (typically within 30 days under PIPEDA, 45 days under CCPA/CPRA extendable by an additional 45 days, and one month under the GDPR extendable by two further months for complex requests).

4. Definitions

• "Personal Information" means information about an identifiable individual under PIPEDA, and "personal data" as defined under the GDPR.
• "Sensitive Personal Information" means a subset of Personal Information that warrants heightened protection, including government identifiers, financial credentials, precise geolocation, biometric and health data.
• "Voice Data" means any audio recording of human speech, the textual transcription, embedded acoustic features (including voiceprints), and any derivative analytic output generated by MataVoice or any subprocessor.
• "Caller" means any natural person who initiates or receives a call, SMS, or other voice or text interaction with a MataVoice-powered voice agent deployed by a Matador Media client.
• "Client" means a person or entity that has entered into a written or electronic engagement with Matador Media.
• "Subprocessor" means a third-party service provider engaged by Matador Media, including Retell AI, Twilio, OpenAI, Anthropic, ElevenLabs, Deepgram, AWS, GCP, Azure, HubSpot, GoHighLevel, Mortgage Automator, Stripe, and Constant Contact.

5. Categories of Personal Information We Collect

The categories below are exhaustive of what Matador Media collects in the ordinary course of business, although not every category applies to every individual.

5.1 Identifiers and Contact Information

Full name, postal/billing address, phone numbers, email addresses, job title and employer, business registration and tax identifiers where relevant to invoicing.

5.2 Commercial Information

Records of services purchased, considered, or quoted, payment information processed through tokenized PCI-DSS compliant processors (we do not store full credit card numbers), and engagement history.

5.3 Internet and Network Activity

IP address and approximate geographic location, browser and device type, pages viewed and clickstream, cookies, pixels, and analytics technologies (Google Analytics, Meta Pixel, LinkedIn Insight Tag).

5.4 Audio, Voice, and Communications Data (MataVoice)

When a Caller interacts with MataVoice we process: the full audio recording, real-time and post-call transcripts, acoustic features and speaker embeddings, call metadata (ANI/DNIS, timestamps, duration, disposition), structured AI outputs (intents, entities, sentiment, summaries), and any information voluntarily disclosed during the call.

CALL RECORDING NOTICE: Calls handled by MataVoice are recorded. In all-party-consent jurisdictions (including under s. 184 of the Criminal Code and U.S. states such as California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, and Washington), MataVoice provides an audible recording disclosure at the outset of the call. Callers who do not consent may disconnect or request transfer to a human where offered.

5.5 Biometric Identifiers and Voiceprints

Speech-to-text and speaker-diarization subprocessors may generate transient voiceprints solely to distinguish speakers within a single call. Voiceprints are not used for cross-call identification unless the deploying Client has obtained explicit written consent under applicable biometric laws (BIPA, Texas CUBI, Washington Biometric Privacy Act). Transient voiceprints are discarded when the call concludes unless retention is contractually required and consented to.

5.6 Inferences and AI-Generated Content

Profile inferences, predicted intent, predicted creditworthiness (in mortgage marketing contexts), lifetime value predictions, AI-generated summaries, lead scoring, and next-best-action recommendations.

5.7 Professional/Employment Information

Information from job applicants (resumes, cover letters, employment history) and information about representatives of corporate Clients.

6. Sources of Personal Information

• Directly from you when you complete a form, subscribe, request a quote, sign an engagement, or speak with a MataVoice agent.
• Automatically through technology via cookies, tracking pixels, and telephony metadata.
• From Clients when they upload contact lists or customer databases for use with our Services.
• From Subprocessors and partners such as analytics providers, ad platforms, and CRMs.
• From publicly available sources such as business registries, professional directories, and LinkedIn for legitimate B2B development consistent with CASL's implied-consent framework.

7. Purposes for Which We Use Personal Information

We use Personal Information only for purposes a reasonable person would consider appropriate, and only with the consent (express or implied) required by applicable law.

7.1 To Provide the Services

To deliver services under an engagement, including MataVoice operation, marketing campaigns, content production, automation workflows, and analytics.

7.2 To Operate and Improve MataVoice

To route, transcribe, summarize, and analyze calls; deliver structured outputs to Client CRMs; monitor quality and reliability; and debug and improve performance subject to Section 11.

7.3 To Communicate With You

To respond to inquiries, send transactional communications (invoices, receipts, security notifications), and send CASL-compliant commercial electronic messages.

7.4 To Market Our Services

To send newsletters and promotional communications subject to CASL, GDPR, and CCPA/CPRA. You may withdraw consent at any time via the unsubscribe link or by emailing privacy@matadormedia.ca.

7.5 To Comply With Legal Obligations

To comply with tax, accounting, anti-fraud, and consumer-protection laws; respond to lawful authority requests; enforce our Terms; and establish or defend legal claims.

7.6 To Protect Matador Media, Our Clients, and the Public

To detect and prevent fraud, abuse, security incidents, and to protect rights, property, and safety.

8. Legal Bases for Processing (GDPR/UK GDPR)

For individuals in the EEA, UK, or Switzerland we rely on: consent (Art. 6(1)(a)) for marketing, non-essential cookies, and sensitive data; contract (Art. 6(1)(b)) to provide Services and administer payment; legal obligation (Art. 6(1)(c)); and legitimate interests (Art. 6(1)(f)) to operate, secure, and improve the Services, conduct B2B outreach, enforce rights, and protect against fraud. You may object to legitimate-interest processing at any time by contacting privacy@matadormedia.ca. For Article 9 special categories we rely on explicit consent or legal claims.

9. Cookies and Similar Tracking Technologies

9.1 Categories

• Strictly necessary — required for the Website to function; cannot be disabled.
• Performance and analytics — GA4 with IP anonymization enabled.
• Functional — remember inputs, language preferences, and chat-widget state.
• Targeting and advertising — Meta Pixel, LinkedIn Insight Tag, Google Ads conversion tags.

9.2 Your Choices

A consent banner allows you to accept, reject, or customize cookies on first visit. You may change preferences any time via "Cookie Preferences" in the footer, or via browser controls. To opt out of GA, install the Google Analytics Opt-Out Browser Add-On. For interest-based advertising, see youradchoices.ca, aboutads.info, or networkadvertising.org.

9.3 Do Not Track

We do not currently respond to DNT signals. We honor a Global Privacy Control signal where required by applicable law, including under the CCPA/CPRA.

10. MataVoice: Detailed Privacy Practices

10.1 Architecture and Subprocessors

Principal subprocessors may include: Telephony — Twilio; Voice AI orchestration — Retell AI or comparable; Speech-to-text — Deepgram or comparable; Text-to-speech — ElevenLabs or comparable; LLMs — OpenAI and Anthropic; Cloud — AWS, GCP, Azure; CRM — HubSpot, GoHighLevel, and Client-designated platforms. A current list is provided to Clients on request. Each subprocessor is bound by written terms no less protective than those Matador Media has accepted to its Clients.

10.2 Retention of Voice Data

• Audio recordings: retained up to 90 days from the date of the call, subject to Client instructions and legal obligations.
• Transcripts: retained up to 24 months for analytics, lead nurturing, and reporting.
• Voiceprints and speaker embeddings: discarded at end of call unless explicit Caller consent has been obtained for longer retention.
• Structured outputs and lead records: retained as directed by the deploying Client.

On termination, Matador Media returns or securely deletes Voice Data and other Personal Information at the Client's option, except as required by law.

10.3 Use of Voice Data for AI Model Training

Matador Media does not use Voice Data to train, fine-tune, or evaluate any generally available foundation model or LLM, and contractually prohibits each subprocessor from doing so. Client-specific fine-tuning occurs only with written Client authorization and only for that Client's deployment.

10.4 Transcription Accuracy and Limitations

Speech recognition is probabilistic. Transcripts may contain errors, particularly with unfamiliar accents, background noise, or out-of-distribution terminology. Automated transcripts should not be the sole record where material legal, financial, or medical consequences depend on precise wording.

10.5 AI Hallucinations and Summarization Risk

LLM outputs may be fluent but factually incorrect. We implement guardrails (retrieval-augmented prompting, output validation, human-in-the-loop for high-stakes outputs) but cannot guarantee accuracy. Outputs are decision-support, not authoritative determinations.

10.6 Compliance With Telephone Consumer Protection Laws

For outbound calling/SMS, the deploying Client is responsible for TCPA consent, CRTC Unsolicited Telecommunications Rules and Canadian National DNCL compliance, A2P 10DLC registration, and equivalent rules. Matador Media supports consent capture and suppression workflows but does not warrant the legality of any individual outbound campaign.

11. Disclosures of Personal Information

11.1 To Subprocessors

Subprocessors are contractually bound to process Personal Information only on documented Matador Media instructions, implement appropriate safeguards, restrict access on a need-to-know basis, and assist with data-subject rights requests and incident response.

11.2 To Clients

Personal Information collected by MataVoice from a Caller is disclosed to the Client on whose behalf the agent is operating.

11.3 To Professional Advisors

We may disclose information to our legal counsel, accountants, auditors, and insurers under professional confidentiality duties.

11.4 In Connection With a Business Transaction

We may disclose Personal Information in connection with a merger, acquisition, financing, or change of control. Any acquirer will be bound by terms at least as protective as this Policy.

11.5 To Comply With Law and Protect Rights

We may disclose information where necessary to comply with legal obligations, defend our rights, investigate wrongdoing, protect personal safety, or protect against legal liability.

11.6 With Consent

We may disclose Personal Information with your consent or at your direction.

11.7 No Sale of Personal Information

Matador Media does not sell Personal Information for monetary consideration and does not share for cross-context behavioral advertising under the CCPA/CPRA, except to the extent advertising cookies described in Section 9 may constitute "sharing." You may exercise opt-out rights via Cookie Preferences or by emailing privacy@matadormedia.ca.

12. International Transfers of Personal Information

Our subprocessors operate in the U.S., EU, UK, and other jurisdictions. Personal Information may be transferred to and processed in countries other than where it was collected. For EEA/UK/Swiss transfers we implement appropriate safeguards including the EU Standard Contractual Clauses (Decision (EU) 2021/914), the UK IDTA, and supplementary measures post-Schrems II. For Canadian residents' information transferred to service providers outside Canada, Matador Media remains accountable under PIPEDA.

13. Security Safeguards

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
• Least-privilege access controls, MFA for administrative accounts, role-based provisioning.
• Logging, monitoring, and alerting for unusual access.
• Periodic vulnerability scanning and penetration testing.
• Documented incident response plan.
• Personnel screening (where permitted), confidentiality agreements, privacy/security training.
• Vendor risk assessments before onboarding subprocessors.

No security program is perfect. If you suspect your Personal Information has been compromised, contact privacy@matadormedia.ca immediately.

14. Data Breach Notification

If a breach creates a real risk of significant harm, we will notify affected individuals, the OPC (where required by PIPEDA), relevant GDPR supervisory authorities, and applicable U.S. state regulators within required timelines. We maintain breach records for the period required by PIPEDA (currently 24 months) and other applicable laws.

15. Retention of Personal Information

We retain Personal Information only as long as necessary to fulfill the purposes for which it was collected, provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Retention is determined by sensitivity, risk of harm, processing purposes, alternative means, and applicable legal requirements (typically six to seven years for financial records under Canadian law). When no longer required, information is destroyed, erased, or de-identified.

16. Your Rights

16.1 Rights Available to All Individuals

• Right of access to your Personal Information.
• Right of correction for inaccurate or incomplete information.
• Right to withdraw consent, subject to legal or contractual restrictions.
• Right to complain to our Privacy Officer at privacy@matadormedia.ca, with escalation to the OPC.

16.2 Additional Rights for EEA, UK, and Swiss Residents

Right to erasure, restriction of processing, data portability, objection, freedom from solely automated decision-making producing significant effects, and the right to lodge a complaint with your local supervisory authority.

16.3 Additional Rights for California Residents (CCPA/CPRA)

Right to know, delete, correct, opt out of sale/sharing, limit use of sensitive Personal Information, and non-discrimination for exercising your rights. You may exercise rights yourself or through an authorized agent; we will verify your identity.

16.4 How to Exercise Your Rights

Contact privacy@matadormedia.ca with the subject "Privacy Rights Request." Describe the right you wish to exercise and provide information sufficient to verify your identity.

17. Children's Privacy

The Services are not directed to children. We do not knowingly collect Personal Information from children. If we learn we have collected such information without verified parental consent, we will delete it promptly. Contact privacy@matadormedia.ca with any concerns.

18. Third-Party Websites and Services

The Services may contain links to third-party websites we do not operate. We are not responsible for their privacy practices. Review the privacy notices of any third-party services you use.

19. Automated Decision-Making and Profiling

MataVoice and other Services use automated processing, including profiling, to classify intent, score leads, personalize communications, and detect fraud. These are decision-support tools and do not produce legal or similarly significant effects without meaningful human review, except with explicit consent or where authorized by law. You may obtain meaningful information about the logic involved and contest decisions by contacting privacy@matadormedia.ca.

20. Changes to This Policy

We may amend this Policy from time to time. Material changes will be posted on the Website with an updated "Last Updated" date and, where required, notified by email or prominent notice. Your continued use after the effective date constitutes acceptance.

21. How to Contact Us

Privacy Officer
Matador Media Inc.
King City, Ontario, Canada
Email: privacy@matadormedia.ca
General: hello@matadormedia.ca

If you are not satisfied with our response, you may contact: the Office of the Privacy Commissioner of Canada (priv.gc.ca, 1-800-282-1376); the Information and Privacy Commissioner of Ontario (ipc.on.ca); your local EEA/UK/Swiss data protection authority; or the California Privacy Protection Agency (cppa.ca.gov) if you are a California resident.

© 2026 Matador Media Inc. All rights reserved.